ANS-C01 Network Design Practice Question

A company has a VPC with CIDR 10.0.0.0/16 and two subnets: 10.0.1.0/24 (public) and 10.0.2.0/24 (private). The company wants to add a new subnet for a third tier. Which of the following are valid subnet CIDRs that can be added? (Select TWO.)

⚠ Common exam trap

AWS often tests the misconception that a subnet can be a subset of an existing subnet (e.g., 10.0.1.128/25 within 10.0.1.0/24), but AWS explicitly prohibits overlapping CIDR blocks within a VPC.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

10.0.3.0/24

(10.0.3.0/24) is correct because it falls within the VPC CIDR 10.0.0.0/16 and does not overlap with the existing subnets (10.0.1.0/24 and 10.0.2.0/24). The /24 prefix length matches the existing subnet structure, and the third octet (3) is outside the range of the first two subnets, ensuring no IP address conflict.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
10.0.1.128/25
Why it's wrong here
This overlaps with the existing public subnet 10.0.1.0/24.
✓
10.0.3.0/24
Why this is correct
This is within the VPC CIDR and does not overlap with existing subnets.
✓
10.0.0.0/24
Why this is correct
This is within the VPC CIDR and does not overlap; it is a new block.
✗
10.1.0.0/16
Why it's wrong here
This is outside the VPC CIDR 10.0.0.0/16.
✗
10.0.2.64/26
Why it's wrong here
This overlaps with the existing private subnet 10.0.2.0/24.

Visual reference

Go deeper

ANS-C01 Network Design Practice Question

Why each option matters

Option-by-option breakdown

Related to this question